The vulnerability exists in dracut's die() function, which writes error messages into shell scripts under the initramfs emergency-hook directory without proper shell quoting. When the error message contains data derived from the DHCP ROOT_PATH option, an attacker controlling a rogue DHCP server on the adjacent network can inject a command-substitution sequence. This sequence executes with root privileges the next time dracut sources its emergency hook scripts during boot-failure handling. Exploitation requires network booting with DHCP-supplied ROOT_PATH and failure in netroot handler resolution, conditions controlled by an adjacent attacker. The vulnerability is distinct from CVE-2026-6893 and affects Red Hat Enterprise Linux 10. No official fix or patch is currently confirmed. Red Hat rates the impact as Important with a CVSS 3.1 score of 7.5 (High).

Successful exploitation allows an adjacent network attacker controlling a rogue DHCP server to execute arbitrary OS commands as root during the boot-failure emergency shell invocation. This can lead to full system compromise, including unauthorized code execution, data modification, and denial of service. The attack vector is limited to systems performing network boot with DHCP-supplied ROOT_PATH values and experiencing netroot handler resolution failure. Systems not using network boot or DHCP ROOT_PATH are not affected.

Red Hat advises restricting DHCP server access on networks used for network boot by implementing DHCP snooping or using dedicated/trusted provisioning VLANs until an official fix is released. No official patch or fix is currently available. Systems not using network boot or DHCP ROOT_PATH are not exposed to this vulnerability. Monitor Red Hat's advisory for updates on patch availability.